Information processing apparatus, control method for information processing apparatus, and storage medium

Abstract

An information processing apparatus includes a detection unit configured to detect unauthorized access to the information processing apparatus; a blocking unit configured to block the unauthorized access; a restricting unit configured to restrict functions of the information processing apparatus; an identifying unit configured to identify a source of the unauthorized access based on a state of access to the restricted functions; a countermeasure unit configured to perform a countermeasure based on information on the source of the unauthorized access; and a canceling unit configured to cancel the restricting of the functions after the countermeasure has been performed.

What is claimed is: 
     
         1 . An information processing apparatus comprising:
 at least one memory storing instructions; and   at least one processor that, upon execution of the stored instructions, is configured to operate as:   a detection unit configured to detect unauthorized access to the information processing apparatus;   a blocking unit configured to block the unauthorized access;   a restricting unit configured to restrict functions of the information processing apparatus;   an identifying unit configured to identify a source of the unauthorized access based on a state of access to the restricted functions;   a countermeasure unit configured to perform a countermeasure based on information on the source of the unauthorized access; and   a canceling unit configured to cancel the restricting of the functions after the countermeasure has been performed.   
     
     
         2 . The information processing apparatus according to  claim 1 ,
 wherein the detection unit detects behavior not performed by the information processing apparatus when there is no unauthorized access as behavior performed during unauthorized access.   
     
     
         3 . The information processing apparatus according to  claim 1 ,
 wherein the blocking unit blocks the unauthorized access by restarting the information processing apparatus.   
     
     
         4 . The information processing apparatus according to  claim 1 ,
 wherein the restricting unit restricts functions by disabling the functions to be restricted.   
     
     
         5 . The information processing apparatus according to  claim 1 ,
 wherein the restricted functions include a function of obtaining information from another apparatus connected to the information processing apparatus.   
     
     
         6 . The information processing apparatus according to  claim 1 ,
 wherein the restricted functions include a function of distributing a payload to another apparatus connected to the information processing apparatus.   
     
     
         7 . The information processing apparatus according to  claim 1 ,
 wherein the identifying unit identifies the source of the unauthorized access based on a characteristic of an attacker attempting to access the at least one of the restricted functions.   
     
     
         8 . The information processing device according to  claim 7 ,
 wherein the characteristic of the attacker includes one or more of an IP address, a port, and a protocol used to access the information processing apparatus, and a process executed when an event associated with the functions restricted by the restricting unit occurred.   
     
     
         9 . The information processing apparatus according to  claim 1 ,
 wherein the countermeasure unit adds an IP address of the source of the unauthorized access to a deny list of a firewall.   
     
     
         10 . The information processing apparatus according to  claim 1 ,
 wherein the countermeasure unit closes a port of the source of the unauthorized access.   
     
     
         11 . The information processing apparatus according to  claim 1 ,
 wherein the countermeasure unit disables a protocol of the source of the unauthorized access.   
     
     
         12 . The information processing apparatus according to  claim 3 , further comprising:
 a tamper detection unit that performs tamper detection processing after the information processing apparatus restarts.   
     
     
         13 . The information processing apparatus according to  claim 12 , further comprising:
 a recovery unit that performs recovery processing when the tampering has been detected by the tamper detection unit.   
     
     
         14 . The information processing apparatus according to  claim 1 ,
 wherein the countermeasure unit performs a countermeasure against leakage of sensitive information stored in the information processing apparatus after the functions have been restricted.   
     
     
         15 . The information processing apparatus according to  claim 1 ,
 wherein the canceling unit cancels restrictions of the restricted functions based on a manual operation by an administrator.   
     
     
         16 . The information processing apparatus according to  claim 1 ,
 wherein the information processing apparatus is an image forming apparatus.   
     
     
         17 . A control method for an information processing apparatus, the control method comprising:
 detecting unauthorized access to the information processing apparatus;   blocking the unauthorized access;   restricting functions of the information processing apparatus;   identifying a source of the unauthorized access based on a state of access to the restricted functions;   taking a countermeasure based on information on the source of the unauthorized access; and   canceling the restricting of the functions after the countermeasure has been performed.   
     
     
         18 . A non-transitory computer-readable storage medium having stored therein a program for causing a computer to execute a control method for an information processing apparatus, the control method comprising:
 detecting unauthorized access to the information processing apparatus;   blocking the unauthorized access;   restricting functions of the information processing apparatus;   identifying a source of the unauthorized access based on a state of access to the restricted functions;   taking a countermeasure based on information on the source of the unauthorized access; and   canceling the restricting of the functions after the countermeasure has been performed.